Mark-of-the-Web Removal by an Unusual Process

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/07/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer
 11package. Attackers can remove this stream to bypass Mark-of-the-Web protections.
 12"""
 13false_positives = [
 14    "Browsers, download utilities, and security tools may remove Mark-of-the-Web during legitimate file handling.",
 15    "Administrative scripts and software deployment tools may intentionally unblock trusted executables or installers.",
 16]
 17from = "now-9m"
 18index = ["logs-endpoint.events.file-*"]
 19language = "eql"
 20license = "Elastic License v2"
 21name = "Mark-of-the-Web Removal by an Unusual Process"
 22references = [
 23    "https://www.forcepoint.com/blog/x-labs/screenconnect-attack",
 24    "https://www.sonicwall.com/blog/living-off-legit-tools-stealthy-installation-of-remote-monitoring-agents-using-smartscreen-bypass",
 25    "https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/",
 26    "https://www.cyfirma.com/research/apt36-multi-vector-execution-malware-campaign-targeting-indian-government-entities/"
 27]
 28risk_score = 21
 29rule_id = "757371cd-5e9e-4adb-bc4e-d81f0ad0ec4d"
 30setup = """## Setup
 31
 32This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 33
 34Setup instructions: https://ela.st/install-elastic-defend
 35"""
 36severity = "low"
 37tags = [
 38    "Domain: Endpoint",
 39    "OS: Windows",
 40    "Use Case: Threat Detection",
 41    "Tactic: Defense Evasion",
 42    "Resources: Investigation Guide",
 43    "Data Source: Elastic Defend",
 44]
 45timestamp_override = "event.ingested"
 46type = "eql"
 47
 48query = '''
 49file where host.os.type == "windows" and event.type == "deletion" and
 50  file.path : (
 51    "*.exe:Zone.Identifier",
 52    "*.exe:Zone.Identifier:$DATA",
 53    "*.msi:Zone.Identifier",
 54    "*.msi:Zone.Identifier:$DATA"
 55  ) and
 56
 57  /* Explorer may remove MOTW after SmartScreen */
 58  not (
 59    process.executable : "?:\\Windows\\explorer.exe" and
 60    process.code_signature.trusted == true and
 61    process.code_signature.subject_name : "Microsoft Windows"
 62  )
 63'''
 64
 65note = """## Triage and analysis
 66
 67### Investigating Mark-of-the-Web Removal by an Unusual Process
 68
 69#### Possible investigation steps
 70
 71- Which process and account removed Mark-of-the-Web from which artifact?
 72  - Focus: Review `file.path`, `process.executable`, `process.name`, `user.name`, and `host.name`.
 73  - Implication: The alert establishes an attributed ADS deletion, not execution or intent. Treat a download, security, or deployment workflow as a benign candidate only when the exact remover, account, artifact, and an independent workflow record align.
 74
 75- Does the deleting-process context fit an expected unblocking workflow?
 76  - Focus: From related process events, review `process.command_line`, `process.parent.executable`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
 77  - Hint: When `process.entity_id` is populated, review events for the same process entity on the alert host $investigate_0
 78  - Implication: PowerShell unblocking or deployment activity needs an expected parent, operator or task, command, and target artifact; a trusted signer alone is insufficient. If `process.entity_id` is absent, use `host.id`, `process.pid`, and a tight alert-time window; missing related process telemetry remains unresolved.
 79
 80- What provenance does the base executable or MSI have?
 81  - Focus: Strip the terminal `:Zone.Identifier` or `:Zone.Identifier:$DATA` suffix, then search same-host file events for the base path and inspect `file.Ext.original.path`, `file.origin_url`, `file.origin_referrer_url`, `file.Ext.windows.zone_identifier`, and `file.hash.sha256` when populated.
 82  - Hint: Start with the 24 hours before the deletion and widen to available retention when necessary.
 83  - Implication: Missing download or file-origin telemetry is unresolved. Consistent source, hash, target directory, and a matching download or deployment record support the claimed workflow.
 84
 85- Was the base artifact executed or used in an installation attempt after deletion?
 86  - Focus: For an EXE, match the base path to `process.executable`; for an MSI, find `msiexec.exe` with the exact base path in `process.args`.
 87  - Hint: Search the same host for five minutes after the deletion, then widen when evidence warrants; review lineage and follow-on file or process activity.
 88  - Implication: A match establishes observed execution or an installation attempt, not maliciousness or installation success. Inconsistent provenance, lineage, or follow-on behavior supports escalation; no match only limits observed impact.
 89
 90- Is the removal isolated or repeated on the host?
 91  - Focus: Review deletions for the same ADS path $investigate_1
 92  - Hint: When `user.id` is populated, review file deletions by the same user and process name, then retain only EXE or MSI `Zone.Identifier` paths $investigate_2
 93  - Implication: If `user.id` is absent, use the exact-path results and a manual same-host search around the alert time. The broader transform returns all file deletions, not only MOTW removal; multiple unrelated matching artifacts support escalation, while a stable release set with the same expected workflow can support benign disposition.
 94
 95- Escalate when remover context, provenance, follow-on behavior, or repeated unrelated targets conflict with an expected workflow. Close only when alert telemetry and an independent download, deployment, or security-tool record align for the exact actor and artifact. Preserve evidence and escalate mixed or incomplete cases.
 96
 97### False positive analysis
 98
 99- Browser, download-handler, security-product, administrative, and deployment workflows can remove Mark-of-the-Web legitimately. Confirm that the process identity and lineage, account and host, exact artifact, provenance, and an independent product or deployment record describe the same workflow before closing the alert.
100- Add an exception only after recurring benign examples establish stable fields. Constrain it to alert fields such as the exact remover executable and signer, target path or package family, and expected account or host class; do not exclude PowerShell or all trusted processes globally.
101
102### Response and remediation
103
104- For unresolved activity, preserve the alert and source events, then recover the deleting-process and artifact context. Do not isolate a host solely on this low-severity signal.
105- If malicious activity or suspicious follow-on behavior is confirmed, contain affected hosts or accounts with reversible controls. Preserve volatile evidence when active or memory-resident behavior warrants it, then terminate malicious processes and quarantine artifacts or persistence after evidence review.
106- For confirmed benign activity, close the alert and consider a narrow exception only after recurring examples establish stable fields. Document affected paths, scope, observed workflow evidence, and telemetry gaps.
107"""
108
109[rule.investigation_fields]
110field_names = [
111    "@timestamp",
112    "event.type",
113    "file.extension",
114    "file.name",
115    "file.path",
116    "host.id",
117    "host.name",
118    "process.code_signature.subject_name",
119    "process.code_signature.trusted",
120    "process.entity_id",
121    "process.executable",
122    "process.name",
123    "process.pid",
124    "user.domain",
125    "user.id",
126    "user.name",
127]
128
129
130[[transform.investigate]]
131label = "Events for the deleting process on this host"
132description = ""
133providers = [
134  [
135    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
136    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
137  ]
138]
139relativeFrom = "now-24h"
140relativeTo = "now"
141
142[[transform.investigate]]
143label = "File deletions for the same ADS path"
144description = ""
145providers = [
146  [
147    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
148    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
149    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
150    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
151  ]
152]
153relativeFrom = "now-24h"
154relativeTo = "now"
155
156[[transform.investigate]]
157label = "File deletions by the same user and process name"
158description = ""
159providers = [
160  [
161    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
162    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
163    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
164    { excluded = false, field = "process.name", queryType = "phrase", value = "{{process.name}}", valueType = "string" },
165    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
166  ]
167]
168relativeFrom = "now-24h"
169relativeTo = "now"
170
171[[rule.threat]]
172framework = "MITRE ATT&CK"
173[[rule.threat.technique]]
174id = "T1553"
175name = "Subvert Trust Controls"
176reference = "https://attack.mitre.org/techniques/T1553/"
177[[rule.threat.technique.subtechnique]]
178id = "T1553.005"
179name = "Mark-of-the-Web Bypass"
180reference = "https://attack.mitre.org/techniques/T1553/005/"
181
182
183
184[rule.threat.tactic]
185id = "TA0005"
186name = "Defense Evasion"
187reference = "https://attack.mitre.org/tactics/TA0005/"